Handle denied browser storage access

Author: roncohen

.changeset/safe-storage-security-error.md

@@ -0,0 +1,5 @@
+---
+"@reflag/browser-sdk": patch
+---
+
+Handle SecurityError when browser storage is unavailable or access is denied.

packages/browser-sdk/src/security-error.ts

@@ -0,0 +1,14 @@
+/**
+ * Test if the error is a security error returned by the browser when cookies or local storage are blocked.
+ * Adapted from the Argos CI project.
+ */
+export function checkIsSecurityError(error: unknown): error is Error {
+  return (
+    error instanceof Error &&
+    // Safari
+    (error.name === "SecurityError" ||
+      // Firefox
+      error.name === "NS_ERROR_FAILURE" ||
+      error.name === "NS_ERROR_ABORT")
+  );
+}

packages/browser-sdk/src/storage.ts

@@ -1,4 +1,5 @@
 import { IS_SERVER } from "./config";
+import { checkIsSecurityError } from "./security-error";
 
 export type StorageAdapter = {
   getItem(key: string): Promise<string | null>;
@@ -14,23 +15,75 @@ export function createNoopStorageAdapter(): StorageAdapter {
   };
 }
 
-export function getLocalStorageAdapter(): StorageAdapter {
-  if (
-    typeof localStorage === "undefined" ||
-    !("setItem" in localStorage) ||
-    !("removeItem" in localStorage)
-  ) {
-    throw new Error(
-      "localStorage is not available. Provide a custom storage adapter.",
-    );
+/**
+ * Get an item from local storage safely.
+ */
+export function getItem(key: string): string | null {
+  try {
+    if (typeof localStorage !== "undefined" && localStorage) {
+      return localStorage.getItem(key);
+    }
+    if (typeof sessionStorage !== "undefined" && sessionStorage) {
+      return sessionStorage.getItem(key);
+    }
+    return null;
+  } catch (error) {
+    if (checkIsSecurityError(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+
+/**
+ * Set an item in local storage safely.
+ */
+export function setItem(key: string, value: string): boolean {
+  try {
+    if (typeof localStorage !== "undefined" && localStorage) {
+      localStorage.setItem(key, value);
+      return true;
+    }
+    if (typeof sessionStorage !== "undefined" && sessionStorage) {
+      sessionStorage.setItem(key, value);
+      return true;
+    }
+    return false;
+  } catch (error) {
+    if (checkIsSecurityError(error)) {
+      return false;
+    }
+    throw error;
+  }
+}
+
+/**
+ * Remove an item from local storage safely.
+ */
+export function removeItem(key: string): void {
+  try {
+    if (typeof localStorage !== "undefined") {
+      localStorage.removeItem(key);
+    }
+    if (typeof sessionStorage !== "undefined") {
+      sessionStorage.removeItem(key);
+    }
+  } catch (error) {
+    if (checkIsSecurityError(error)) {
+      return;
+    }
+    throw error;
   }
+}
+
+export function getLocalStorageAdapter(): StorageAdapter {
   return {
-    getItem: async (key) => localStorage.getItem(key),
+    getItem: async (key) => getItem(key),
     setItem: async (key, value) => {
-      localStorage.setItem(key, value);
+      setItem(key, value);
     },
     removeItem: async (key) => {
-      localStorage.removeItem(key);
+      removeItem(key);
     },
   };
 }

packages/browser-sdk/test/storage.test.ts

@@ -5,9 +5,41 @@ async function loadStorageModule() {
   return import("../src/storage");
 }
 
+const storageDescriptors = {
+  localStorage: Object.getOwnPropertyDescriptor(globalThis, "localStorage"),
+  sessionStorage: Object.getOwnPropertyDescriptor(globalThis, "sessionStorage"),
+};
+
+function restoreStorageDescriptor(name: "localStorage" | "sessionStorage") {
+  const descriptor = storageDescriptors[name];
+  if (descriptor) {
+    Object.defineProperty(globalThis, name, descriptor);
+  } else {
+    delete (globalThis as Record<string, unknown>)[name];
+  }
+}
+
+function defineThrowingStorage(
+  name: "localStorage" | "sessionStorage",
+  errorName = "SecurityError",
+) {
+  Object.defineProperty(globalThis, name, {
+    configurable: true,
+    get() {
+      const error = new Error("Access is denied for this document.");
+      error.name = errorName;
+      throw error;
+    },
+  });
+}
+
 describe("storage adapters", () => {
   afterEach(() => {
     vi.unstubAllGlobals();
+    restoreStorageDescriptor("localStorage");
+    restoreStorageDescriptor("sessionStorage");
+    localStorage.clear();
+    sessionStorage.clear();
   });
 
   it("noop adapter ignores writes", async () => {
@@ -22,14 +54,34 @@ describe("storage adapters", () => {
     expect(await adapter.getItem("key")).toBeNull();
   });
 
-  it("localStorage adapter throws when localStorage is unavailable", async () => {
+  it("localStorage adapter falls back to sessionStorage when localStorage is unavailable", async () => {
     const { getLocalStorageAdapter } = await loadStorageModule();
     vi.stubGlobal("localStorage", undefined);
-    expect(() => getLocalStorageAdapter()).toThrowError(
-      "localStorage is not available. Provide a custom storage adapter.",
-    );
+
+    const adapter = getLocalStorageAdapter();
+
+    await adapter.setItem("fallback", "ok");
+    expect(sessionStorage.getItem("fallback")).toBe("ok");
+    expect(await adapter.getItem("fallback")).toBe("ok");
+
+    await adapter.removeItem?.("fallback");
+    expect(sessionStorage.getItem("fallback")).toBeNull();
   });
 
+  it.each(["SecurityError", "NS_ERROR_FAILURE", "NS_ERROR_ABORT"])(
+    "localStorage adapter ignores %s when storage access is denied",
+    async (errorName) => {
+      const { getLocalStorageAdapter } = await loadStorageModule();
+      defineThrowingStorage("localStorage", errorName);
+
+      const adapter = getLocalStorageAdapter();
+
+      expect(await adapter.getItem("key")).toBeNull();
+      await expect(adapter.setItem("key", "value")).resolves.toBeUndefined();
+      await expect(adapter.removeItem?.("key")).resolves.toBeUndefined();
+    },
+  );
+
   it("default adapter falls back to noop on server runtimes", async () => {
     vi.resetModules();
     vi.stubGlobal("window", undefined);